Mobile application security system and method

Abstract

A system for authenticating the user of a computing device comprises an authorized user directory. Each record is uniquely associated with an authorized user and includes at least a computing device ID value that is a globally unique value assigned to the authorized user's computing device, a group of unique depictions such as photographs, an identification of a key depiction. Portions of each image form fiducials recognizable by the user. The record further includes trace pattern verification data representing continuous trace strokes between pairs of the fiducials within the key depiction. To authenticate, the group of images are displayed to the user. The user must first select the key image and secondly trace continuous trace strokes between the pairs of fiducials to match the trace pattern verification data.

Description

TECHNICAL FIELD[0001]The present invention relates to security for applications operating on a computing device and more particularly to authenticating the user of a computing device.BACKGROUND OF THE INVENTION[0002]Authenticating a user of a computing device in order to provide access to to restricted electronic data or access to restricted services such as banking services is critical for securing data and preventing fraud.[0003]The most common system for authenticating a user is to require the user to enter a user ID and password combination. The password is then compared to a valid password that is stored in a secure location in association with the user ID.[0004]If the user ID and password tendered by the user matches the valid password stored in association with the user ID, the user is granted access to the restricted electronic data or systems. On the other hand, if the user ID does not match a valid user ID's or the password does not match the valid password stored in assoc...

AI Technical Summary

Benefits of technology

The present invention is a system for authenticating the user of a computing device by using a combination of factors, including physical characteristics and behavioral patterns. The system includes an authentication server with an authorized user directory and an authentication application. The user sends a request for authentication to the server, which provides the unique identifier of the user and the unique depictions of the user with a unique fingerprint. The user then captures a continuous trace pattern on the device's touch screen and sends the data to the server for verification. The server matches the continuous trace pattern with the unique depictions in the user's directory to authenticate the user. The system ensures that the user's device ID and the unique depictions match, and the continuous trace pattern verification data includes at least one velocity verification value and a measured time stamp. The technical effect of the invention is to enhance the security of user authentication and prevent unauthorized access to the computing device.

Problems solved by technology

On the other hand, if the user ID does not match a valid user ID's or the password does not match the valid password stored in association with the user ID, the user is denied access.

User ID and password systems are not considered the most secure because it is based solely on the person purporting to be the authorized user having knowledge of the user ID and password.

Because certain biometric characteristics that are typically used for security are unique to each individual, it is extremely difficult for a different person replicate the biometric characteristic of the authentic user.

A challenge with use of biometrics for security and to restrict access to services is that biometric measuring devices are expensive and most biometric measuring devices are no readily portable.

More specifically, although the operator of a fraudulent web site can replicate the genuine website to induce the person to enter his or her user ID, the operator of the fraudulent website does not have access to the user's personally selected site key picture and therefore cannot replicate the genuine site's ability to display the personally selected site key in association with prompting the user to enter his or her password.

Because the typical user becomes accustomed to using the two step log-in process and seeing his / her personally selected site key picture on the genuine web site, the lack of two step log in process and / or the lack of seeing the personally selected site key on a fraudulent web site make its obvious to the user that the website may not be genuine and that he or she should not provide their password.

Images